SYSC 15A.5 Scenario testing

1Firms should ensure that the testing plan takes account of a number of factors, including but not limited to:

1. (1)

   the type of scenario testing undertaken. For example, whether it is paper based, simulations or through the use of live-systems;

2. (2)

   the scenarios which the firm expects to be able to remain within their impact tolerances and which ones they may not;

3. (3)

   the frequency of the testing;

4. (4)

   the number of important business services tested;

5. (5)

   the availability and integrity of supporting assets;

6. (6)

   how the firm would communicate with internal and external stakeholders effectively to reduce the harm caused by operational disruptions.

1Where a firm relies on a third party for the delivery of its important business services, we would expect the firm to work with the third party to ensure the validity of the firm’s scenario testing under SYSC 15A.5.3R. To the extent that the firm relies on the third party to carry out testing of the services provided by the third party to or on behalf of the firm, the firm should ensure the suitability of the methodologies, scenarios and considerations adopted by the third party in carrying out testing. The firm is ultimately responsible for the quality and accuracy of any testing carried out, whether by the firm or by a third party.

1In carrying out the scenario testing, a firm should, among other things, consider the following scenarios:

1. (1)

   corruption, deletion or manipulation of data critical to the delivery of its important business services;

2. (2)

   unavailability of facilities or key people;

3. (3)

   unavailability of third party services, which are critical to the delivery of its important business services;

4. (4)

   disruption to other market participants, where applicable; and

5. (5)

   loss or reduced provision of technology underpinning the delivery of important business services.